Medusa ransomware group claims data breach at Northeast Ohio Neighborhood Health Services

• Ransomware group: Medusa
• Country: United States
• Sector: Healthcare
• Announcement date: April 20, 2024

Medusa claims a data breach involving Northeast Ohio Neighborhood Health Services

The Medusa ransomware group has announced a data leak involving Northeast Ohio Neighborhood Health Services (NEON). According to the group's announcement on their leak site, they claim to be in possession of a significant volume of data belonging to the healthcare provider.

Details of the alleged attack

The threat actor known as Medusa published an announcement on April 20, 2024, regarding Northeast Ohio Neighborhood Health Services (NEON). The group claims to have exfiltrated data following an incident that allegedly occurred on April 18, 2024. This timeline suggests a rapid transition from the initial intrusion to the public announcement on the group's leak site.

Regarding the scope of the compromised information, the group alleges that the total volume of the exfiltrated data amounts to 50.96 GB. However, no detailed information regarding the specific content or the exact nature of the leaked data has been provided by the attackers. Furthermore, no screenshots were provided to verify the contents of the stolen files.

Organization profile

Northeast Ohio Neighborhood Health Services (NEON) is a community health center network based in Cleveland, Ohio. Founded in 1967, the organization serves as a Federally Qualified Health Center (FQHC). As such, it is dedicated to providing accessible healthcare services to the local community.

Risk assessment and industry implications

The alleged breach may pose risks to the security of patient information, given the institution's role in healthcare services. Because the organization is based in the United States, the potential incident may fall under the scope of HIPAA regulations, which govern the protection of sensitive patient health information.

Considering the Medusa group's known use of double-extortion tactics, it is possible that the exfiltrated data could be published or used for ransom demands. In a double-extortion scenario, attackers not only encrypt an organization's systems but also steal sensitive data, threatening to leak it publicly unless a ransom is paid. This tactic places immense pressure on organizations due to the potential for reputational damage and regulatory penalties.

This situation might lead to identity theft or targeted phishing attacks against employees and patients. For organizations in the healthcare sector, such incidents highlight the importance of robust defensive measures. Common defensive steps for organizations facing these threats include implementing strict access controls, maintaining offline backups, and ensuring continuous monitoring of network traffic to detect unauthorized data exfiltration. Public information regarding the Medusa group remains limited.

• No specific data types were named in the listing.